diff --git a/src/aws-cli/README.md b/src/aws-cli/README.md
index 30b88b2..a874222 100644
--- a/src/aws-cli/README.md
+++ b/src/aws-cli/README.md
@@ -116,6 +116,15 @@ Quick create your profile:
 duploctl jit update_aws_config myprofile
 ```
 
+## Shell Compatibility
+
+The on-create script sources the AWS CLI helpers into **every installed shell's** interactive rc
+file — `~/.bashrc` when `bash` is present and `~/.zshrc` when `zsh` is present (appends are
+idempotent). It deliberately does not key off the login shell (`/etc/passwd` / `$SHELL`), because
+images often install zsh as the terminal's default without changing the user's login shell, which
+would leave the actually-used shell unconfigured. This way the helpers load on zsh-based images as
+well as bash.
+
 ## References
 
 - [Duploctl JIT Documentation](https://cli.duplocloud.com/Jit/#duplo_resource.jit.DuploJit.update_aws_config)
diff --git a/src/direnv/README.md b/src/direnv/README.md
index d8f4849..a2e098d 100644
--- a/src/direnv/README.md
+++ b/src/direnv/README.md
@@ -17,6 +17,16 @@ Installs direnv and places a DuploCloud direnvrc at $HOME/direnv/direnvrc
 |-----|-----|-----|-----|
 
 
+## Shell Compatibility
+
+The on-create script installs the direnv configuration into **every installed shell's** interactive
+rc file — `~/.bashrc` with `eval "$(direnv hook bash)"` when `bash` is present, and `~/.zshrc` with
+`eval "$(direnv hook zsh)"` when `zsh` is present (appends are idempotent). It deliberately does not
+key off the login shell (`/etc/passwd` / `$SHELL`): images frequently install zsh and make it the
+terminal's default shell without changing the user's login shell, so detecting a single shell leaves
+the shell the terminal actually launches without the hook. Writing to each installed shell's rc makes
+direnv activate regardless of which shell opens — including zsh-based images such as the Anthropic
+secure-AI reference image.
 
 
 ---
diff --git a/src/gcloud-cli/README.md b/src/gcloud-cli/README.md
index 279c84c..229250e 100644
--- a/src/gcloud-cli/README.md
+++ b/src/gcloud-cli/README.md
@@ -17,6 +17,16 @@ Installs Google Cloud CLI with multi-architecture support
 |-----|-----|-----|-----|
 
 
+## Shell Compatibility
+
+The on-create script configures **every installed shell's** interactive rc file — `~/.bashrc` when
+`bash` is present and `~/.zshrc` when `zsh` is present (appends are idempotent). Each rc sources the
+shell-appropriate gcloud SDK include files (`path.bash.inc` / `completion.bash.inc` for bash, the
+`.zsh.inc` variants for zsh) plus the gcloud helper functions. It deliberately does not key off the
+login shell (`/etc/passwd` / `$SHELL`), because images often install zsh as the terminal's default
+without changing the user's login shell, which would leave the actually-used shell unconfigured. This
+makes the gcloud CLI path and completion load correctly on zsh-based images (such as the Anthropic
+secure-AI reference image) as well as bash.
 
 
 ---
diff --git a/src/onepassword-cli/README.md b/src/onepassword-cli/README.md
index f1720c6..8f711da 100644
--- a/src/onepassword-cli/README.md
+++ b/src/onepassword-cli/README.md
@@ -152,7 +152,7 @@ This authentication method allows biometric authentication within the devcontain
 - Extracted during the sign-in process using `op signin --raw`
 - Mapped to the correct account UUID from `op account list`
 - Exported to the current script environment for immediate use
-- Appended to `.bashrc` for persistence across terminal sessions
+- Appended to every installed shell's rc file for persistence across terminal sessions (see [Shell Compatibility](#shell-compatibility))
 
 **Note**: The account URL may be specified with or without the `https://` prefix. The feature handles both formats when looking up the account UUID.
 
@@ -419,6 +419,15 @@ The install script automatically disables problematic repositories (like yarn) b
 
 This issue is specific to Debian Trixie which uses sequoia (`sqv`) for GPG verification instead of the traditional apt-key approach.
 
+## Shell Compatibility
+
+The on-create script writes its persisted variables and the session-token sourcing line into **every
+installed shell's** interactive rc file — `~/.bashrc` when `bash` is present and `~/.zshrc` when `zsh`
+is present (appends are idempotent). It deliberately does not key off the login shell (`/etc/passwd`
+/ `$SHELL`), because images often install zsh as the terminal's default without changing the user's
+login shell, which would leave the actually-used shell unconfigured. This makes the feature work on
+zsh-based images (such as the Anthropic secure-AI reference image) as well as bash.
+
 ## References 
 
 - [1Password CLI Documentation](https://developer.1password.com/docs/cli) - Official CLI reference and setup guides
diff --git a/src/terraform/README.md b/src/terraform/README.md
index 026f4c3..f2be363 100644
--- a/src/terraform/README.md
+++ b/src/terraform/README.md
@@ -109,7 +109,7 @@ The feature installs `tf.sh` in two locations:
 - `/usr/local/bin/tf` - Executable wrapper (use as `tf` command)
 - `/usr/local/share/duplocloud/tf.sh` - Sourceable shell script (for functions)
 
-Both files are sourced in shell rc files (`.bashrc`, `.zshrc`, `/etc/bash.bashrc`) to make the helper functions available in interactive shells.
+The `tf` wrapper is placed on `PATH`, so it works in any interactive shell (bash or zsh) with no rc-file changes. If you want the underlying helper functions in your current shell, source the sharable copy directly: `source /usr/local/share/duplocloud/tf.sh`.
 
 ## References